Researcher: Smriti Ranabhat

Editor: Nuva Rai

Failure to Protect Personal Data and Privacy Rights

In October, we witnessed institutional weakness over the handling of personal data as well as lack of meaningful consent in digital spaces. For example, sensitive personal and academic records of 862 students of Gandaki University in Pokhara were leaked through the Telegram channel “FORCE ANON”. The incident exposed information of students like contact details, family records, photographs, citizenship certificates and academic transcripts. This spotlights the institutional failure to uphold their duty of safeguarding the confidential information placed in their care. Similarly, Himanshu Shahi, operator of the Facebook pages “Sahara TV HD” and “Sahara TV Khabar,” was arrested for recording and sharing a video related to the Thapa Medical incident without permission. 

In another case, lawmaker Ashika Tamang faced criticism for sharing videos of children recorded using camera equipped smart glasses and sharing the video without blurring in social media platforms. Article 28 of Constitution of Nepal guarantees the right to privacy, while the Act Relating to Children, 2018, also explicitly protects children’s privacy. Privacy violations by a lawmaker are therefore particularly concerning, as elected representatives are expected to understand and uphold these very laws. Smart glasses are often critiqued as “pervert glasses” due to their covert recording capabilities which creates asymmetrical power dynamics where people are filmed without knowledge or consent. In a country where smart surveillance technologies are not yet widely recognized or understood by the general public, their unannounced use by state actors creates an imbalance of power. Though the MP did acknowledge her mistake after the widespread backlash, protecting the privacy of children requires clear legislative standards on public surveillance, institutional accountability for elected officials, and explicit protocols governing the digital rights of minors.

Press Freedom Vs. Police Intervention in Media Houses

Journalism is a cornerstone of democracy and an important check on those in power. However, repeated interference with press freedom threatens democratic values and erodes public trust. In the last week of October, we witnessed police actions against several journalists and media houses which has revived important discussion on press freedom and freedom of expression in Nepal. Police who came in civil dress arrested Nepal Press journalist Bishwamani Subedi from his office. They additionally accessed the premises of Nepal Press, directing both its chairperson, Binduraj Lamsal, and editor-in-chief, Matrika Poudel, to report to the Cyber Bureau for interrogation. He had covered a story claiming that the government had asked IGP Dan Bahadur Karki to resign. Police further detained journalists Shobharaj Baral from MotiveNews and Dhiraj Basnet from DNA Khabar. Similarly, a group identifying themselves as police officers entered the Naya Patrika office and attempted to take journalist Navaraj Mainali for questioning over a news report. All the journalists taken for questioning were later released. Government authorities intervening in media houses without proper authorization and questioning journalists for the stories they have covered are such practices which have no place at democratic state. Such activities reflect fear of the government from independent journalism, its authoritarian attempt to intimidate press and bring press freedom under its control.

The incidents got strong reactions from the Federation of Nepali Journalists, Press Council Nepal, civil society and political representatives. All of these institutions questioned the use of police powers in response to journalistic work. When journalists face police questioning over the stories they publish, it can create fear and discourage reporting on issues involving those in power. Following the criticism, Minister for Communication and Information Technology Bikram Timilsina announced the release of journalists and reaffirmed the government’s commitment to press freedom and responsible journalism. However, the contrast between police action against journalists and the government’s public commitment to press freedom shows the gap between official assurances and practice. 

Cyberattacks Exposed Fragile Digital Infrastructure of Nepal

A wave of cyberattacks on government websites, educational institutions and private sector systems has laid bare how fragile the digital infrastructure of Nepal is. The hacker group Force Anon has claimed responsibility for attacks on the website of the Office of the Attorney General, the government cloud system and Nepal Police Hospital. The government cloud portal was also defaced with the message “Hacked by PSY404”. The extent of the breach and whether any data was exposed, has not been confirmed. Other reported targets include ministry systems, Nepal Police website, Hello Sarkar database, and websites and portals of local and provincial governments.

These incidents point to deeper structural problems like outdated infrastructure, inadequate security safeguards and a shortage of skilled cybersecurity professionals. As more government services move online, cybersecurity should be more prioritized. So, state agencies are responsible for protecting the data people trust to them.

Rising Digital Scams and Financial Fraud

Fraudulent TikTok accounts pretending to be real businesses are catching a growing number of online shoppers in Nepal. A woman from Salyan lost about Rs. 26,000 after ordering T-shirts from an account pretending to be Aarav Fancy. In Pokhara, a customer lost Rs. 4,42,000 while trying to buy a kurta worth just Rs.500 from an account called Sandhya Collection. In this scenario, Kaski Police have suggested people to be careful with suspicious advertisements and offers that look too cheap to be true. Scammers are also pretending to be staff of popular payment services. Four people have been arrested in Bhaktapur for impersonating Khalti employees, getting customers to share their screens and OTP codes, then using them to access bank accounts and digital wallets.

Amid this, authorities are starting to respond. Nepal Rastra Bank has told banks and financial institutions to name dedicated focal persons and keep 24-hour contact channels open, so police can act quickly on fraud complaints. These cases show how far online financial fraud now reaches, from everyday shopping to organised payment scams. Arrests and directives to banks are crucial but they often come after people have already lost their money. Preventing such fraud needs stronger protection before harm occurs. Platforms need to act quickly against fraudulent accounts, victims should have access to timely support and the public needs clear guidance on how to find and avoid online scams.

Global PHP Security Vulnerabilities and Disruption of Digital Services

The discovery of critical PHP vulnerabilities, known as PHP2Shell, have raised cybersecurity concerns worldwide, forcing websites and online services in several countries to temporarily go offline. Nepal was also affected by this, with several government websites, online systems and selected banking services shut down from October 21 as a precaution. The vulnerabilities could allow attackers to run malicious code and take control of affected servers without authentication. In response, the Software Development and Operation Centre, National Cyber Security Centre and other technical agencies formed an emergency team to patch and check vulnerable systems. Authorities clarified that there was no confirmed successful cyberattack on Nepali websites, major data breach or financial loss. Nepal Rastra Bank also assured the public that core banking systems and customer funds remained safe. More than a thousand government websites and online services later resumed operations after security updates. But some portals including those of Nepal Rastra Bank, Social Security Fund and Election Commission remained inaccessible pending further security checks and technical clearance. 

Globally, Censys reported that more than 32.6 million PHP based services remained vulnerable, despite over 9.1 million having received security updates. Disruptions in widely used technology can affect public services and banking systems, as well as raise questions about how institutions can protect themselves.

Misinformation in Times of Crisis

The rapid spread of false and misleading content on social media is making it increasingly difficult for the public to know what information to trust. Old footage and unverified claims are often presented as current events which create confusion and distort public understanding. 

Recently after the recent floods, Indian media outlet NDTV India cited footage from a January 2021 avalanche near Kapuche Lake in Kaski for a report on a recent avalanche near Himlung Himal in Manang. Similarly, a viral claim that 41 Nepalese had converted to Islam following the Bhotekoshi floods in Rasuwa was found to be false. As religion is a sensitive issue, spreading fabricated claims around religion can fuel mistrust and hurt communal sentiment. The dissemination of misinformation and disinformation during the time of emergencies and disasters can make the public more panic, confused and disturbed.

In another case, a video showing Rastriya Swatantra Party (RSP) chairperson Ravi Lamichhane commenting on the controversy involving lawmaker Khagendra Sunar and journalist Kishor Shrestha was found to be AI-generated or manipulated. There is a risk that such content can spread widely before it is properly verified. It can deepen public mistrust, fuel fear and hostility and make it hard for people to engage in fact based discussions on issues.

References: